1.10 Ensure 'Transport Pickup Directory Path' is not set

Information

The Pickup directory is used by the Transport service on Mailbox servers and Edge Transport servers to insert message files directly into the transport pipeline. When properly formatted email message files are copied to the Pickup directory, they are submitted for delivery automatically. It is a legacy feature that can be used by administrators for mail flow testing, or by applications that must create and submit their own messages.

Ensure PickupDirectoryPath is set to $null

Rationale:

Disabling the Pickup directory is recommended to prevent potential abuse by attackers or insiders seeking to exploit side channel attacks. Dropping a file in the Pickup folder bypasses the normal authentication process of Exchange, creating a risk of sensitive data leakage or malicious email distribution through this unauthenticated side channel.

Impact:

The directory will be unavailable for testing purposes unless an administrator explicitly enables it and then later disables it. If an application requires access to this directory, then additional controls should be enabled such as restricting NTFS permissions on the folder.

Solution

To implement the recommended state, execute the following PowerShell cmdlet to disable the Pickup Directory on the Edge Transport server:

Get-TransportService | Set-TransportService -PickupDirectoryPath $null

Default Value:

%programfiles%\Microsoft\Exchange Server\V15\TransportRoles\Pickup

See Also

https://workbench.cisecurity.org/benchmarks/12442

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7

Plugin: Windows

Control ID: 3c64fe9e645cbfb67762e651d3687c1cb0f4bf180d931609b3537fb51dcb0bd2